4 ms·

To what extent is any hardware manufacturer responsible for malicious usage of their product in your opinion? Surely you don't believe that all bases can be cov

To what extent is any hardware manufacturer responsible for malicious usage of their product in your opinion? Surely you don't believe that all bases can be covered no matter how simple the product prior to launch. I credit Apple for making a best effort at launch and continuing security and support for much longer than the industry standard in their products. But realistically there is no way to launch something flawless as you seem to be suggesting.

CamperBob2 5y ago
You're both right; it's an interesting question. Something that can't be used maliciously is probably not useful for much of anything at all. OTOH, when the potential for harm is far greater than the potential for good, as it arguably is here, that calls for extra discretion on the part of the developers.
- phil21 5y ago
  > as it arguably is here That may be understating it a bit. I honestly can't decide which is greater. Airtags as-is are nerfed for non-technical reasons as to make them more or less useless to me, despite their ability to be incredibly useful. For example: Due to the nag/anti-stalking alerts I can't put them on dog collars due to day-care visits. No way for others to whitelist a tag on their phone, or any way to silence it. Same goes now for the car. It's annoying to just toss one in each trunk in case of theft or whatnot, since the cars are shared. The privacy concerns have more or less turned this product into something of a very narrow usage band - aside from a personal bookbag or whatnot I don't see many other realistic uses at this time. Not useful for hiding in my power tools, etc. etc. I had pretty high hopes for these for some peace of mind (dogs), and I live in a high crime area so being able to track my expensive items has proven useful in the past. I was excited about expanding on this use until they started crippling them.
bitexploder 5y ago
Meanwhile, you can get a cheap GPS tracker for the price of an AirTag or two…
- Syonyk 5y ago
  And if you want it to report out, it has to have an active cell plan, and the power consumption is rather radically higher than "years on a button cell," so the device is bigger, it needs a clear enough view of the sky to get a GPS signal, etc. They're an awful lot less useful and less discreet. Again, not impossible by any means, but certainly quite a bit less convenient than an AirTag with a removed speaker.
  - badwolf 5y ago
    Or just get a Tile, that will ping any Amazon echo or Ring doorbell it goes near.
  - olliej 5y ago
    I just checked and all the reports of misuse so far don’t seem to be “for months at a time”. I can also get a prepaid sim with very little identification and there’s no direct link from an arbitrary gps device to the person who used it. I think there was a brief surge in people abusing them because they thought AirTags were untraceable, which they very explicitly are not. As apple says in the article they can directly go from an AirTag to the account that owns it.
    - vineyardmike 5y ago
      > I just checked and all the reports of misuse so far don’t seem to be “for months at a time”. Its also only like 6-8 months old at this point.
  - drdaeman 5y ago
    I don't think the typical issue is that someone can maliciously track some other person specifically for years. Longevity of the tracker is an added benefit, not what makes it different. Honestly, in my personal opinion I feel that only thing that's really different is the company's notoriety. It's no fun to bash Tile (people just don't have any beef with them), but kinda fun when it's Apple. And that they've actually sent out a viral idea ahead of product release focusing attention on this aspect (so, naturally, it echoes back).
throw10920 5y ago
I think that a key issue in this case isn't just that Apple made a device that could be used for tracking - after all, you could engineer or buy a different tracking device from a number of vendors - but that its feasibility was massively increased due to a unique Apple asset - its network of iDevices. That is, Apple released a product that was uniquely good at tracking people due to an Apple-specific asset. Slightly less, but still very importantly, there's the fact that by design you can't see if someone is tracking you unless you buy another Apple product, which wasn't an intrinsic engineering limitation, but just a choice that Apple made for their own profit.
- varenc 5y ago
  Apple released an Android app that lets you check for AirTags separated from their owner near you: https://play.google.com/store/apps/details?id=com.apple.trackerdetect https://play.google.com/store/apps/details?id=com.apple.trac... Of course you have to know about it and it only provides scanning when the app is open instead of constantly doing it in the background like iOS.
- dragonsky67 5y ago
  Makes me wonder how much liability the owner or participants in the network used for tracking carry if bad things are facilitated by the network.
- rootusrootus 5y ago
  > its feasibility was massively increased As was the risk of getting jail time if you use it to stalk someone. Something you don't really worry about with a generic GPS tracker. That handy, convenient AirTag will give the police your address.
Syonyk 5y ago
I don't think all bases can be covered, certainly. But neither do I think Apple has been doing a good job of even trying to do a good job of it, at least recently. Apple clearly put some thought into how the product would be misused, and added some features for that - but then appears to have not bothered having actual (simulated malicious) users test those features to see how they'd bypass them. Things like "removing the speaker" seem oddly trivial, yet there's no indication Apple even thought through that situation. It wouldn't be too difficult to design something in which the deliberate disabling of the speaker rendered the device useless after a few days, yet would be unlikely to trip in normal use. They're pretty well sealed. "Red teaming" something like this in the early design phases is often useful to be able to figure out how to mitigate these sorts of attacks, and Apple, far too often lately, seems to be in a "...they did what? No, they can't have... we didn't think they'd... ugh, OK, let's add something to support that..." mode. And if they don't have family sharing support, as seems to be the case from the other comments here, it clearly means they weren't tested with any sort of realistic use case, because "Oh, yeah, my wife's keys in her purse keep making my phone go off when we're driving together" seems a common use case to discover in testing. I don't think a company should be responsible for all malicious uses, but when those uses seem utterly trivial to manage (remove speaker, your tracking target uses Android and like almost all Android users hasn't downloaded Apple's app to check for AirTags following them), I think they've missed something really important in the design phase.
- 323 5y ago
  Making AirTags safe is fundamentally impossible, a bit like trying to make a knife impossible to hurt yourself with. For example: > deliberate disabling of the speaker rendered the device useless after a few days That only kicks the can. Now people will silence the speaker from outside, for example by covering the whole AirTags in superglue and foam to muffle all vibrations.
  - Syonyk 5y ago
    > for example by covering the whole AirTags in superglue and foam to muffle all vibrations. Which makes it larger, harder to hide, and easier to find. Go try - see how much foam it takes to reasonably muffle the beeper. It'll take a lot more than you think.
drdaeman 5y ago
I'd really want to ask weird and possibly insensitive, but nonetheless (I believe) a legit question - shouldn't be it a society that needs to somehow change (I've no idea how, though), rather than technologies killed because it threats existing societal stuff? I hate to say this but it really feels that our assumptions of privacy are becoming outdated and there's no going back. Unlike e.g. facial recognition, AirTags are not even some new breakthrough, just some well-known existing technologies made a bit more mainstream/commonly available (can't even say "more affordable", the price point hadn't changed). Yet, it causes an uproar. Technological genie just cannot be put back in the bottle and it's only gonna get worse in the future, as tech will become smaller, smarter and more magical.
- Syonyk 5y ago
  > ...shouldn't be it a society that needs to somehow change (I've no idea how, though), rather than technologies killed because it threats existing societal stuff? We've allowed, collectively, anything that falls in the "tech" realm to deploy first, ask questions later, and more or less force society to conform. I think it's been absurd, we see more and more backlash against it, and rightly so. A company shouldn't be able to just ignore the law and do whatever they want because they use computer chips, but we've seen more or less exactly that in a number of cases. - Uber/AirBnB can be seen as venture-capital funded, money losing ways around existing taxi/hotel/rental laws, and their tendency to expand into a market without permission and then demand the right to stay there against the laws that prohibit exactly such things, is an example of this model. - The various "Dump tons of scooters in a city without asking, profit, and make cleanup the city's problem" is another example here. It's littering, really, but somehow tech companies involved get a pass because it's neat. - Literally every "We collect all the behavioral data you don't realize we're collecting to improve our models of you so we can sell better advertisements to our actual customers" business model does the same thing - take first, ask permission never (or, at least, try very hard to never have the topic come up). I'm not OK with this, and I hope more and more people aren't OK with it either. > I hate to say this but it really feels that our assumptions of privacy are becoming outdated and there's no going back. Privacy shouldn't be something subject to the current state of technological surveillance. We should, as a society, decide what privacy ought to be, and then limit tech companies accordingly. Europe seems to be making decent headway on this front, with "No, you can't just keep doing that..." rulings against tech companies. I hope that spreads.

CamperBob2 5y ago

You're both right; it's an interesting question. Something that can't be used maliciously is probably not useful for much of anything at all. OTOH, when the potential for harm is far greater than the potential for good, as it arguably is here, that calls for extra discretion on the part of the developers.

phil21 5y ago
> as it arguably is here That may be understating it a bit. I honestly can't decide which is greater. Airtags as-is are nerfed for non-technical reasons as to make them more or less useless to me, despite their ability to be incredibly useful. For example: Due to the nag/anti-stalking alerts I can't put them on dog collars due to day-care visits. No way for others to whitelist a tag on their phone, or any way to silence it. Same goes now for the car. It's annoying to just toss one in each trunk in case of theft or whatnot, since the cars are shared. The privacy concerns have more or less turned this product into something of a very narrow usage band - aside from a personal bookbag or whatnot I don't see many other realistic uses at this time. Not useful for hiding in my power tools, etc. etc. I had pretty high hopes for these for some peace of mind (dogs), and I live in a high crime area so being able to track my expensive items has proven useful in the past. I was excited about expanding on this use until they started crippling them.

bitexploder 5y ago

Meanwhile, you can get a cheap GPS tracker for the price of an AirTag or two…

Syonyk 5y ago
And if you want it to report out, it has to have an active cell plan, and the power consumption is rather radically higher than "years on a button cell," so the device is bigger, it needs a clear enough view of the sky to get a GPS signal, etc. They're an awful lot less useful and less discreet. Again, not impossible by any means, but certainly quite a bit less convenient than an AirTag with a removed speaker.
- badwolf 5y ago
  Or just get a Tile, that will ping any Amazon echo or Ring doorbell it goes near.
- olliej 5y ago
  I just checked and all the reports of misuse so far don’t seem to be “for months at a time”. I can also get a prepaid sim with very little identification and there’s no direct link from an arbitrary gps device to the person who used it. I think there was a brief surge in people abusing them because they thought AirTags were untraceable, which they very explicitly are not. As apple says in the article they can directly go from an AirTag to the account that owns it.
  - vineyardmike 5y ago
    > I just checked and all the reports of misuse so far don’t seem to be “for months at a time”. Its also only like 6-8 months old at this point.
- drdaeman 5y ago
  I don't think the typical issue is that someone can maliciously track some other person specifically for years. Longevity of the tracker is an added benefit, not what makes it different. Honestly, in my personal opinion I feel that only thing that's really different is the company's notoriety. It's no fun to bash Tile (people just don't have any beef with them), but kinda fun when it's Apple. And that they've actually sent out a viral idea ahead of product release focusing attention on this aspect (so, naturally, it echoes back).

throw10920 5y ago

I think that a key issue in this case isn't just that Apple made a device that could be used for tracking - after all, you could engineer or buy a different tracking device from a number of vendors - but that its feasibility was massively increased due to a unique Apple asset - its network of iDevices. That is, Apple released a product that was uniquely good at tracking people due to an Apple-specific asset. Slightly less, but still very importantly, there's the fact that by design you can't see if someone is tracking you unless you buy another Apple product, which wasn't an intrinsic engineering limitation, but just a choice that Apple made for their own profit.

varenc 5y ago
Apple released an Android app that lets you check for AirTags separated from their owner near you: https://play.google.com/store/apps/details?id=com.apple.trackerdetect https://play.google.com/store/apps/details?id=com.apple.trac... Of course you have to know about it and it only provides scanning when the app is open instead of constantly doing it in the background like iOS.
dragonsky67 5y ago
Makes me wonder how much liability the owner or participants in the network used for tracking carry if bad things are facilitated by the network.
rootusrootus 5y ago
> its feasibility was massively increased As was the risk of getting jail time if you use it to stalk someone. Something you don't really worry about with a generic GPS tracker. That handy, convenient AirTag will give the police your address.

Syonyk 5y ago

I don't think all bases can be covered, certainly. But neither do I think Apple has been doing a good job of even trying to do a good job of it, at least recently. Apple clearly put some thought into how the product would be misused, and added some features for that - but then appears to have not bothered having actual (simulated malicious) users test those features to see how they'd bypass them. Things like "removing the speaker" seem oddly trivial, yet there's no indication Apple even thought through that situation. It wouldn't be too difficult to design something in which the deliberate disabling of the speaker rendered the device useless after a few days, yet would be unlikely to trip in normal use. They're pretty well sealed. "Red teaming" something like this in the early design phases is often useful to be able to figure out how to mitigate these sorts of attacks, and Apple, far too often lately, seems to be in a "...they did what? No, they can't have... we didn't think they'd... ugh, OK, let's add something to support that..." mode. And if they don't have family sharing support, as seems to be the case from the other comments here, it clearly means they weren't tested with any sort of realistic use case, because "Oh, yeah, my wife's keys in her purse keep making my phone go off when we're driving together" seems a common use case to discover in testing. I don't think a company should be responsible for all malicious uses, but when those uses seem utterly trivial to manage (remove speaker, your tracking target uses Android and like almost all Android users hasn't downloaded Apple's app to check for AirTags following them), I think they've missed something really important in the design phase.

323 5y ago
Making AirTags safe is fundamentally impossible, a bit like trying to make a knife impossible to hurt yourself with. For example: > deliberate disabling of the speaker rendered the device useless after a few days That only kicks the can. Now people will silence the speaker from outside, for example by covering the whole AirTags in superglue and foam to muffle all vibrations.
- Syonyk 5y ago
  > for example by covering the whole AirTags in superglue and foam to muffle all vibrations. Which makes it larger, harder to hide, and easier to find. Go try - see how much foam it takes to reasonably muffle the beeper. It'll take a lot more than you think.

drdaeman 5y ago

I'd really want to ask weird and possibly insensitive, but nonetheless (I believe) a legit question - shouldn't be it a society that needs to somehow change (I've no idea how, though), rather than technologies killed because it threats existing societal stuff? I hate to say this but it really feels that our assumptions of privacy are becoming outdated and there's no going back. Unlike e.g. facial recognition, AirTags are not even some new breakthrough, just some well-known existing technologies made a bit more mainstream/commonly available (can't even say "more affordable", the price point hadn't changed). Yet, it causes an uproar. Technological genie just cannot be put back in the bottle and it's only gonna get worse in the future, as tech will become smaller, smarter and more magical.

Syonyk 5y ago
> ...shouldn't be it a society that needs to somehow change (I've no idea how, though), rather than technologies killed because it threats existing societal stuff? We've allowed, collectively, anything that falls in the "tech" realm to deploy first, ask questions later, and more or less force society to conform. I think it's been absurd, we see more and more backlash against it, and rightly so. A company shouldn't be able to just ignore the law and do whatever they want because they use computer chips, but we've seen more or less exactly that in a number of cases. - Uber/AirBnB can be seen as venture-capital funded, money losing ways around existing taxi/hotel/rental laws, and their tendency to expand into a market without permission and then demand the right to stay there against the laws that prohibit exactly such things, is an example of this model. - The various "Dump tons of scooters in a city without asking, profit, and make cleanup the city's problem" is another example here. It's littering, really, but somehow tech companies involved get a pass because it's neat. - Literally every "We collect all the behavioral data you don't realize we're collecting to improve our models of you so we can sell better advertisements to our actual customers" business model does the same thing - take first, ask permission never (or, at least, try very hard to never have the topic come up). I'm not OK with this, and I hope more and more people aren't OK with it either. > I hate to say this but it really feels that our assumptions of privacy are becoming outdated and there's no going back. Privacy shouldn't be something subject to the current state of technological surveillance. We should, as a society, decide what privacy ought to be, and then limit tech companies accordingly. Europe seems to be making decent headway on this front, with "No, you can't just keep doing that..." rulings against tech companies. I hope that spreads.